hxxps://gofile[.]io/d/a1fQzI

Analysis

user interaction
yes
max time kernel
329s
max time network
331s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/a1fQzI
Sample260801-d4rcfada53

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
105	api.gofile.io
35	api.gofile.io
36	api.gofile.io
38	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300288559412713"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{EA71D3E4-8C78-4B58-99F7-9FFEFF8D8A09}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4944	952	msedge.exe	85
PID 952 wrote to memory of 3188	952	msedge.exe	86
PID 952 wrote to memory of 5016	952	msedge.exe	87
PID 952 wrote to memory of 4644	952	msedge.exe	88
PID 952 wrote to memory of 5016	952	msedge.exe	87
PID 952 wrote to memory of 5016	952	msedge.exe	87
PID 952 wrote to memory of 4644	952	msedge.exe	88
PID 952 wrote to memory of 2496	952	msedge.exe	89
PID 952 wrote to memory of 3728	952	msedge.exe	90
PID 952 wrote to memory of 2496	952	msedge.exe	89
PID 952 wrote to memory of 2496	952	msedge.exe	89
PID 952 wrote to memory of 3728	952	msedge.exe	90
PID 952 wrote to memory of 3728	952	msedge.exe	90
PID 952 wrote to memory of 4696	952	msedge.exe	92
PID 952 wrote to memory of 3128	952	msedge.exe	93
PID 952 wrote to memory of 4696	952	msedge.exe	92
PID 952 wrote to memory of 4696	952	msedge.exe	92
PID 952 wrote to memory of 3128	952	msedge.exe	93
PID 952 wrote to memory of 3128	952	msedge.exe	93
PID 952 wrote to memory of 764	952	msedge.exe	98
PID 952 wrote to memory of 764	952	msedge.exe	98
PID 952 wrote to memory of 764	952	msedge.exe	98
PID 952 wrote to memory of 2408	952	msedge.exe	99
PID 952 wrote to memory of 4176	952	msedge.exe	100
PID 952 wrote to memory of 2408	952	msedge.exe	99
PID 952 wrote to memory of 4176	952	msedge.exe	100
PID 952 wrote to memory of 1032	952	msedge.exe	102
PID 952 wrote to memory of 3572	952	msedge.exe	105
PID 952 wrote to memory of 2752	952	msedge.exe	106
PID 952 wrote to memory of 2856	952	msedge.exe	107
PID 952 wrote to memory of 776	952	msedge.exe	112
PID 952 wrote to memory of 776	952	msedge.exe	112
PID 952 wrote to memory of 1876	952	msedge.exe	115
PID 952 wrote to memory of 1876	952	msedge.exe	115
PID 952 wrote to memory of 3312	952	msedge.exe	117
PID 952 wrote to memory of 5072	952	msedge.exe	118
PID 952 wrote to memory of 2196	952	msedge.exe	119
PID 952 wrote to memory of 5072	952	msedge.exe	118
PID 952 wrote to memory of 2196	952	msedge.exe	119
PID 952 wrote to memory of 2956	952	msedge.exe	120
PID 952 wrote to memory of 2956	952	msedge.exe	120
PID 952 wrote to memory of 2748	952	msedge.exe	121
PID 952 wrote to memory of 2748	952	msedge.exe	121
PID 952 wrote to memory of 4420	952	msedge.exe	122
PID 952 wrote to memory of 4420	952	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/a1fQzI
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x260,0x7fffd007c188,0x7fffd007c194,0x7fffd007c1a0
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,12140709642532020031,7744431107100972856,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,14925708160417977788,12945338473014412681,262144 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,14811824232983543898,10856087366368490659,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,8186485959782904531,10813402956724825988,2097152 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,11187603214437262224,14246282058741655807,2097152 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,11720549759092594310,8245508283958419928,2097152 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,7477789328875642186,15699806002162473078,2097152 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,2508848599441911198,9228997175409021781,2097152 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,17065489354819808801,11375231260575395149,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,7541687976655002280,1846150328160362565,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,12357940061298560380,12834203783169108378,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,12357940061298560380,12834203783169108378,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3733362147127697805,17066848194644434379,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,8617724964651367823,1670604058662975711,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,6783752057465529957,9299955878183194475,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,16912231127916885040,17638056948176896374,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3821741239648235756,15430767495135941908,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,9019886593946573548,2311779528613663999,262144 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,9067981580578583741,16059117669194364770,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,11245842069893751638,8367283816317975373,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,9933626036122201492,16664050766185620128,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1931631870248263683,5922809269533157429,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,16389340491088429267,3329602958892971687,524288 --field-trial-handle=2376,i,15176908059973697690,5689343269140245272,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 712033e1b9316df047938de5d8515a12e02322b10f6e56ba7d4b5bff3f3b7970
MD5 eb0b16ee9e33b9f664c86edebb592103
SHA1 a1611e26097be2b810dc13e739ab0dd7334872b0
SHA512 cfe6dc1cf10c0f6ead5ee6767648988add82e384c3263967e3cfdd93f88c8466662139515a40f2eae7762955db71c0a86d34e9d08e0f6d2bb4a7e4f306a3894b
SSDEEP 192:3jCKvVyyf2KKBQQS7U11enAAdPdPjjjjjqqNMkLO:3jCKvVyyf2KKBQQS7U11enAAdPdPjjj0
TLSH
T151E1309242D4D39BDF2611CB8990929F50B1370BEFDCD50C035CE9DE344E5EAA5A5AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 a0998060bb720420a6e9fa3571dc72604bec94f7a7c9853a5992b13ea9eef9ba
MD5 b5b82b49709ebdf0e1b9971a800a6731
SHA1 1f09ea48e6f39d5f803d02008a21ede64523c9d7
SHA512 1e0f383229c7dbcf6f4ba2f438c1b91d89afbf0035ee4489b47665cae7ff993c97e0361a499799d5e9928770114ebff1ac4c551279b74636966769cda0372872
SSDEEP 192:1jFBAXXXuuuuEEENNWWWWWWWWWWqRqRqRqRzzzM7LO:1jFBAXXXuuuuEEENNWWWWWWWWWWqqqq7
TLSH
T19AE14D5382D4D3AA8F1661CB89A0525D10B03B0BEFDCDA0C136DDDDD304F9DAB9A5AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cb7c13ab384418022b275738d335f104f8ccadd223a43b9123fd69b3ab4f09f1
MD5 f291e1c462fc76256bcfb6635fc19122
SHA1 3396a5bc2c50eb34096c195de7a1544a693637f1
SHA512 d2f4a0e390872611f32f7f04031a8e64f745a99343ccfaa2aa63adcf0573acde6ddfbe1a11a42121c79c4950f1ee1e268fa368c5aa969990064f720520d883b5
SSDEEP 96:ePmBeNuT6rB3SOc9wYDnpPk/amYug8ZjMUI3JMkEoSbs3TrmBh1q:e+BeMT693Sb9wYDpPk/amYz8ZAUgJMkD
TLSH
T1CA81E52D068B45B3E31C2732E8D319D97235CDA44FA70DE35034893C16AEB55CBE5168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 fa03f3947f28690a7fbaf8ec313ee0adca177370ba09beb6d63b57f14434ec05
MD5 8310d622bfbb71eb595fb3aa93dd9856
SHA1 57c4dd86ae04fc723e59cc2e88ace617c94acff6
SHA512 5cbff2b323ef5f00cd7d2f8d1a53d10a27746ed5527e4f94f3840f3eb66ad6fa40799f236b94bcf4bde5248e9b253d2d7a4e644191051f3b0447525bbd2b571e
SSDEEP 48:eDmW7RMnAO/MTHE2FPb3vk6UfZVbeJtGscscGCWpEayFHLXMZe0fY88I8GcmdUBj:SRT6r3OcfnzCYuejMUIY0SGWCi1
TLSH
T1C381F92E460A6473E39C2231D0DB05C9B234CD944FA70DA3903E99BE26AFB58CBD106C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588c3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588c3d.TMP
Size 3KB
SHA256 606bcfe4bfeea999a6e2a8b8f570ad3cfe808033f3b891cc3fa04ac5e0be652d
MD5 7ce6c21f249678e4db3df1c6fa5b6782
SHA1 54e8031ea3ed4049f28949980effa4384523683d
SHA512 959d916754affdcea078350847557c6ab3adc4ee7c38e00d34366ff967809269140f81b389017ebea2a00d5455dc5129cdb237cdf61bc6acbe6aed1a30b30a6f
TLSH
T18971E82D080E49A3E31C2732E0E3098AB274CD994FD74EA35038993C568EB56CBE546C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b2318927d7f388c1655904c7db0369b4f47c234cd965af55519837b146c4cbb6
MD5 970745b276bdf3e9e41f2991caa24cc1
SHA1 3437345ce18da57ec7b8e93e1667a0f3566ce66f
SHA512 720274351ba15e460da998c6b34df473ca818b1a734149ed6c9d610c8a4dc2740c3a71c5c44a7c78eca1c916c2e02efa7514e531b798c40d329e327017bf7c7d
TLSH
T1B4219EF383E5956ECD1556F09A14AE1BCE1C0515832C7D2989D4AE27A3E3471E00165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f55423458387bd79fa79de157103a6cfedeca258720f667b390c588a9322b7d2
MD5 5b3ce3a1ca71f7550afa059bb6a024de
SHA1 478109c08bd63deb6ca76f61124ecbd531cb2eaf
SHA512 6cd873ce62fadf658aaa9302cefb80e197c84acbbf4eac5ef12d9ea7429d82236df79544853d5f40cc13bf0afa42d5281330838d7ce59af8663aeefe04ac3841
SSDEEP 192:sxZcRRyM/jK1Ml8Mki/fNs7ukIdpjllHW6+WNezx/YH+Xg8IgrJ:sxZcHMi/fNs7u9THbg/P9
TLSH
T1B65209156A346A77CCDBD209F945BF53D6F50432A2941E48A9FCDA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5710e5fbec7461a863170720b5a5a50bb301a6ba1c4581f2629d3f58afc33634
MD5 80a0e7e0fdf5749003bd2c46ee959ee2
SHA1 451c2d8a8bae0bd9af72f7b06c1983d0ee38f4f9
SHA512 c321ca7e695eea803fbcab16eadb58f2f0cf52796f8f7e5be9f3f3929725efa853c9cff5321d92d99e574acb4265bd72619f55ac833cc26f1e0da7f796d6dc88
SSDEEP 192:sxZcRRyM/jK1Ml8UQbki/fNsi+kIdpRllHW6+WNewhXYHvmI8Ig5BJ:sxZcHqwi/fNsi+95Hb/X1N
TLSH
T11052E8166A34A977CCDBD209F985BF53D6F5047292941E44A9FCDA1C00EBBED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 36ef3e829736f5caedef2f51df9a3c31c669b1b7f850757f466a041655c0c4b4
MD5 a10ba658ecfb9cef5a79a98b9d1fe5ab
SHA1 9c314e5b1da90229f13dc8aa0fe439ef355571fe
SHA512 3796f99f9ed63c1a35df9c88eadf5b1bdf225099515cf1935bf4ee95a50dbb4342b34d46cf0fdbbdb7ef2d3e478b256270e135da1bcf29083f12bbc351d77bc0
SSDEEP 768:BIUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R6roV400:BIUZYTMWvg0Pou1ja7eLZmRxt0
TLSH
T1C8D21B2F284CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA884C03CB6EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 d23cf63eefcaa294ec77427b263a8118161445cb1b6980fed4a61a6de4b32043
MD5 ebc3a5c9f97d40f2823ea3f796033111
SHA1 f23242df6749941693d6dfcc676385538ae1fe5b
SHA512 34e29c725d851779f615902ee5b1366370a3df03ca0942ee7eeae13cf1032a7f0a497e24d80aa36153eb0f0382cf791ae23df5a5603c5d1e457bb3a4142d80d2
TLSH
T108312E499EA0C99FF8A441B210B6A1A47370D8CC5B12A3139C2C21327E2771A2A9B1ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ccfbb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5ccfbb.TMP
Size 1KB
SHA256 6f59cfa88d79cdaf3db1715494f07be09b8d720373ba6214a2b25c28f3f6856d
MD5 6a23d7475fb91d55afbbb7f2b3132257
SHA1 13d7783ea1f21a5f2480b844e3ee755ee4bb1946
SHA512 5ff8bad6c4dabe5daa5ebca5dcbeb5a4ff0ea268469bb6708571c76be6ab232b0c7534eee911226f2090419a023a645f31c6d4aadfa98bbf26611c85b3986eb1
TLSH
T18731864B4A808E4BF8C450B709A7A4B87336C9408321B383987C2239AD31B9E2F4F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dbb19421b6da972a2801e69d4e9fe75181470b2fa21b6476b8c08d49e3dfa283
MD5 382b48190a47d539976d9dbb69534e1c
SHA1 9369d8355a96b31810fe33cf0725ed7d64cbec07
SHA512 492ec71186966825fb97b6e24fa787c5c6d347b66ac0c3ad782c56a2f174bbde60124030603e07cb635bc6bdb5593f88daae58334624324962a3ef74f9c24f0d
TLSH
T10EE0C0F77DFB1820AD7FC3D74471E4A402013CB8C64DAD8E00AAB2A310B23002806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ed781cf1f30f0e8b4b57a63f95652f097117e380c5c6542e261308b1b8cd443d
MD5 02b9e0bbba3eb7d2b2da1fa7deb3482d
SHA1 07c615f52f9e99e9f7e631bcf1d47d5d455e5471
SHA512 988b96ac24436c5d5e3e2d3d17965d775917b943d1dea1b93cb54bf99845393a8eb93cf32850b7ec66c9deb8233271958dd85c87279d0ff6a0ad67311f20048e
SSDEEP 96:KA1eK2AMaMKXqOCOkKHqUdOKmkS2LWKEgA:EurfyVlZ
TLSH
T11DD1E10272BB02033D7D2918A39987764F46F6A33418A42B7FA840B55E67E345DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591c96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591c96.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fb5e46adcc2546d45241e766e26bec9ebccbc1c70a810869b98ff56e6ab33f85
MD5 b464aa1a5d8fdd81d918d85deffe7023
SHA1 133d3435d266ca8e3844255d6e5c3fcd47b8e544
SHA512 40b272795fa3dfa4d38f5705978e69758b0ca257bc76d43503e8bccb3fdf71b3bc252158aa0a096f0d2349862f9bdf3f22487fe0b103bc5eea9bd642023ee8ee
SSDEEP 384:+ZcIhsNlXEckRIEFnzX5od+d8y0VuXRtlBnTKwBODNZOCT30N:8hBcSbO7+RtlBnewBKZOE30N
TLSH
T16C927E35A838AC779EE2B145F84B32038FF89167E6C83F94D6ED6B1C0199598130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dc4469aa9ef8027f988247ea331c30c104973fdf52bcecbb239f2d787c3ea950
MD5 6d19e6192a05a5ceaf67f6a2a7249cd9
SHA1 bafe755633f53e88e8d9eabde512a87c0e9ada77
SHA512 f1e5b5fce521ee79105c1614d525b5e582793c6d4a88bd835ca219ce755c53bbfee06a25cb944a4ab2853b9b239b5a1bf98135e2f7d3e0615e9197095e3feda4
SSDEEP 192:yONR61VWQmiUyFogGX5Obd+j1jzory0aoX/al831IU6:yONR6WHgGX5od+d8y0VCl2IU6
TLSH
T11F02D839A9286CBB8EE2BE4AB48737135FD51067EA552F84D6F81B1C009769C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f712f35fa2879c417f178494ed21a7ac4b83c8c60aaa2d07805181bd981d31c8
MD5 ca737febc74f07525534bef123727a1a
SHA1 951275cc1a9f45339a4fb3ef750090502e1c2023
SHA512 027b8b231d03109dc15d48b6096a6660ec40eb85857bd897b438452e8da5394e794c72b468d6106e9f0be5e7464ce3281b4b4ea467d563d79bb842a48fe08bdf
SSDEEP 384:0iFiZcICzsN/8TUNTUlIl+EckRIEknzX5od+d8y0VuXRxlBnTKwBODNZOCT30N:PFQKGwgjcjbO7+RxlBnewBKZOE30N
TLSH
T1E5D22AF658E79836D9AE5747B77D2D024EBCC063F5846A50B3985A1CCC561BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fa4ce01875624181240e01a9ad7bdb17fa94a4f7ee1ac3f5e050f244a0f5429d
MD5 9034a79ef1769fe9da2ee36235ab7179
SHA1 288bcbfb26310d7ef811a2b1d73b17abea284f1c
SHA512 21596b634c931e9dd566a0d9e069416548cd78a068d698b11da3f3a48e87a25f1d4dcbf1cdbed92ba3ebe64a8a6a010677f39bd4659b6d35ab4e57ffc849451a
SSDEEP 192:+ONg61LWQmiUyQoVGX5Obd+j1jzory0aouX6E5jJlGqVU6:+ONg68gVGX5od+d8y0VuXR7lBU6
TLSH
T1C712FA36A468AC679EE3B585B48732139FE55167DB497F8092EC2B1C01EF5AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ed734187b9ba9ec2594e2245329205b9995d828c3cb6e131b3d5d9e3a09772ef
MD5 857e494b40ccb01c326201cb507d81d4
SHA1 5eb6e71e17473ce51e33c06d998bc307c310ad65
SHA512 193d91fc36896ca5e7f6a26c7125ceda0fcdb8e86c73072d3a57b4ceb65a1a769c362adaf417bd315e23635eab419857477bc9c921b19e769c6ea8c55f63747a
SSDEEP 384:YZcIhsNl+EckRIEFnzX5od+d8y0VuXRtlBnTKwBODNZOCT30N:mhqcSbO7+RtlBnewBKZOE30N
TLSH
T11F927E356838AC779EE2B145F84B32038FF89167E6D83F94D6EDAB1C0199598130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d7ab8ba-5a84-4632-b771-55a810a38f24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2d7ab8ba-5a84-4632-b771-55a810a38f24.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a37327e36b60a9a347080bce58952806fca2156c7974c9229e34bbecc03ce1d
MD5 8b15aa1892fccc4114ab3a1c7900fdd9
SHA1 952fea8ec49cb348257608393579a9c26e0bee2c
SHA512 a6e540efdcff0b894d7bd9399529fe25025d4825701edc90d000f8518af28fc03a0b1a4f14c5563ecf50bdca01a657edef5b7abe53a0b0e2321caabacf1bac87
TLSH
T1C2414858B6FA1149B3B76F59ABF6A86D483FBD332E06D05D00100E4E4672A00C871737
MD5 SHA1 SHA512 TLSH

Submit Download